Skip to content
Noroxi

CWE-347 · 898 records

Improper verification of cryptographic signature

Why does it happen?

The verifier takes the algorithm to verify with from the token’s own header. Untrusted data ends up deciding its own verification rule.

How to prevent it

  1. 01Pin the accepted algorithm on the server.
  2. 02Always validate the issuer (iss), audience (aud) and expiry (exp) claims.
  3. 03Don’t mix asymmetric and symmetric verification families on the same endpoint.

Vulnerable and fixed code

A representative teaching example. Highlighted lines mark where the bug and the fix are.

Vulnerable

ts
const claims = jwt.verify(token, publicKey);

Fixed

ts
const claims = jwt.verify(token, publicKey, {  algorithms: ["RS256"],  issuer: "https://id.example.com",  audience: "portal",});

Is this pattern in your code?

We look for this class specifically as part of our Web and API penetration testing service. Findings are delivered with line numbers.

Web and API penetration testingRequest a quote

CVEs in this class

902 records

  • CVE-2026-48558
    92Now

    SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

    CriticalCVSS 9.5KEVWeaponizedEPSS 80%

    simple-help · simplehelpJun 12, 2026

  • CVE-2025-59718
    89Now

    A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti

    CriticalCVSS 9.8KEVWeaponizedEPSS 68%

    fortinet · fortiproxyDec 9, 2025

  • CVE-2026-5430
    77This week

    Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

    CriticalCVSS 10.0KEVWeaponizedEPSS 22%

    wso2 · api control planeAug 6, 2026

  • CVE-2020-1464
    73This week

    Windows Spoofing Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 38%

    microsoft · windows 10 1507Aug 17, 2020

  • CVE-2020-2021
    71This week

    PAN-OS: Authentication Bypass in SAML Authentication

    CriticalCVSS 10.0KEVWeaponizedEPSS 4%

    paloaltonetworks · pan-osJun 29, 2020

  • CVE-2013-3900
    65This week

    WinVerifyTrust Signature Validation Vulnerability

    MediumCVSS 5.5KEVWeaponizedEPSS 44%

    microsoft · windows 10 1507Dec 11, 2013

  • CVE-2026-0265
    60This week

    PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled

    HighCVSS 7.2WeaponizedEPSS 1%

    paloaltonetworks · pan-osMay 13, 2026

  • CVE-2025-25292
    57Plan

    Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

    CriticalCVSS 9.3No exploitEPSS 65%

    omniauth · omniauth samlMar 12, 2025

  • CVE-2021-22160
    55Plan

    Authentication with JWT allows use of “none”-algorithm

    CriticalCVSS 9.8No exploitEPSS 52%

    apache · pulsarMay 26, 2021

  • CVE-2018-16042
    51Plan

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and ear

    MediumCVSS 6.5No exploitEPSS 82%

    adobe · acrobat dcJan 18, 2019

  • CVE-2025-47827
    50Plan

    In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature.

    MediumCVSS 4.6KEVWeaponizedEPSS 5%

    igel · igel osJun 5, 2025

  • CVE-2025-59719
    47Plan

    An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 t

    CriticalCVSS 9.8No exploitEPSS 27%

    fortinet · fortiwebDec 9, 2025

  • CVE-2024-9487
    46Plan

    An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed

    CriticalCVSS 9.5Proof of conceptEPSS 25%

    github · enterprise serverOct 10, 2024

  • CVE-2018-0114
    43Plan

    A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens u

    HighCVSS 7.5Proof of conceptEPSS 42%

    cisco · node-joseJan 4, 2018

  • CVE-2025-25291
    43Plan

    ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

    CriticalCVSS 9.3Proof of conceptEPSS 20%

    omniauth · omniauth samlMar 12, 2025

  • CVE-2024-45409
    43Plan

    The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    onelogin · ruby-samlSep 10, 2024

  • CVE-2021-37160
    41Plan

    A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of softwar

    CriticalCVSS 9.8No exploitEPSS 8%

    swisslog-healthcare · hmi-3 control panel firmwareAug 2, 2021

  • CVE-2021-33885
    41Plan

    An Insufficient Verification of Data Authenticity vulnerability in B.

    CriticalCVSS 9.8No exploitEPSS 5%

    bbraun · spacecom2Aug 25, 2021

  • CVE-2025-29775
    40Plan

    xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    node-saml · xml-cryptoMar 14, 2025

  • CVE-2025-29774
    40Plan

    xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

    CriticalCVSS 9.3Proof of conceptEPSS 9%

    node-saml · xml-cryptoMar 14, 2025

  • CVE-2018-12356
    40Plan

    An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2.

    CriticalCVSS 9.8No exploitEPSS 4%

    simple password store project · simple password storeJun 14, 2018

  • CVE-2018-8955
    40Plan

    The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which al

    CriticalCVSS 9.8No exploitEPSS 4%

    bitdefender · gravityzoneOct 24, 2018

  • CVE-2018-1000076
    40Plan

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series

    CriticalCVSS 9.8No exploitEPSS 2%

    rubygems · rubygemsMar 13, 2018

  • CVE-2018-5923
    40Plan

    In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signature

    CriticalCVSS 9.8No exploitEPSS 2%

    hp · color laserjet cm4540 mfp firmwareMar 27, 2019

  • CVE-2019-6318
    40Plan

    HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an ins

    CriticalCVSS 9.8No exploitEPSS 2%

    hp · color laserjet cm4540 mfp firmwareApr 11, 2019

All vulnerability classes